KB5087537 May 2026 breaks domain controller lookups

Microsoft says the KB5087537 May 2026 security update can cause domain controller discovery to fail on Windows Server 2016 when the server hostname is exactly 15 characters long—returning ERROR_INVALID_PARAMETER and disrupting administrative tasks like DFS Nam

By the time the May 2026 update finishes installing, the problem can already be baked in: on Windows Server 2016 systems, domain controller discovery may stop working.

Microsoft has confirmed a new known issue tied to KB5087537, a May 2026 security update. The failure shows up after installation on Windows Server 2016, but only under a specific condition—the device hostname must be exactly 15 characters long.

When that length requirement is met, Microsoft says domain controller discovery might fail. In its support documentation. the company explains that DCLocator calls—such as running nltest /dsgetdc: /pdc—will return ERROR_INVALID_PARAMETER. That error prevents applications and administrative tools from locating a domain controller.

The consequences aren’t limited to a single command line. Microsoft also warns that the known issue may affect certain administrative scenarios that require access to a domain controller. When domain controller lookup fails, administrative operations that rely on it might fail too, impacting scenarios including DFS Namespace management.

Microsoft says it is investigating the domain controller lookup issue, but it has not provided a timeline for a fix.

The update comes at a tense moment for organizations still running Windows Server 2016. Microsoft noted that Windows Server 2016 reached the end of mainstream support in January 2022. while the company pushed back the extended support end date by 5 years to allow customers to migrate to newer Windows Server versions.

In recent weeks. Microsoft also confirmed other Windows update troubles after admins installed the January 2026 optional non-security preview updates in restricted network environments. The company further reported Windows 11 security update deployment issues caused by insufficient free space on the EFI System Partition (ESP).

Last month, Microsoft warned that some Windows Server 2025 devices may boot into BitLocker recovery and then released emergency out-of-band updates to fix issues that caused Windows Server systems with domain controller roles to enter a restart loop.

And just last month before that—April—Microsoft addressed a separate problem that had been affecting Windows servers since September 2024. In that case, devices running Windows Server 2019 and Windows Server 2022 upgraded to Windows Server 2025 unexpectedly.

All of those recent fixes and failures, taken together with this new hostname-triggered domain controller discovery break, create the same operational dilemma for administrators: even as they patch, the very tools they depend on to manage identity and directory services can become unreliable.

Microsoft Windows Server 2016 KB5087537 May 2026 security update domain controller DCLocator nltest ERROR_INVALID_PARAMETER DFS Namespace management Windows updates cybersecurity system administration